View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0010746 | Scribus | Releases | public | 2012-06-11 11:31 | 2021-11-09 21:39 |
Reporter | swilde | Assigned To | malex | ||
Priority | normal | Severity | major | Reproducibility | always |
Status | closed | Resolution | unable to reproduce | ||
Platform | All Debian and Ubuntu Versions | ||||
Summary | 0010746: Scribus Debian Archive Signing Key can not be verified | ||||
Description | The Key used to sign the apt-repository on debian.scribus.net (EEF818CF) can not be verified. The key is signed by three persons: sig 719A575E 2007-03-12 Dale Wilcox (Work Key) <Dale@BUZZCommunications.biz> sig 8EC3CA88 2008-07-30 Léo Studer <leo.studer@gmail.com> sig AA23C71C 2009-03-28 Jakub Žá?ek <dawon.cz@gmail.com> But all three of these keys are only self signed or signed by worthless keys (like PGP Global Directory Verification Key or 8108B88E, which is not available on public key servers). So it is not possible to have a OpenPGP trust path to the signing key. An alternative would be to have a trusted source for the fingerprint of the signing key, but the full fingerprint is not published on http://wiki.scribus.net/canvas/Debian nor any other place I found, let alone on a https accessible site with a certificate from a trusted CA... | ||||
Tags | No tags attached. | ||||
Patch | |||||
Date Modified | Username | Field | Change |
---|---|---|---|
2012-06-11 11:31 | swilde | New Issue | |
2012-06-11 13:22 | ale | Assigned To | => malex |
2012-06-11 13:22 | ale | Status | new => assigned |
2015-05-25 04:29 | Kunda | Note Added: 0035230 | |
2021-10-29 22:13 | cbradney | Status | assigned => resolved |
2021-10-29 22:13 | cbradney | Resolution | open => unable to reproduce |
2021-11-09 21:39 | cbradney | Status | resolved => closed |